“Worm” is a collective term of programs that repeatedly perform an infecting action for a vulnerable host computer on a network to bring the network to a halt. Conventionally, whether or not communication is performed by a worm has been determined by binary values. Accordingly, the number of responses for the determination result is two.
As a conventional art relating to the present invention, there is known a technique that detects a worm based on a threshold value with respect to the number of packet destinations during a predetermined monitoring period so as to detect an unknown worm in an early stage (refer to, e.g., Patent Document 1).
Patent Document 1: Jpn. Pat. Appln. Laid-Open Publication No. 2005-134974